Privacy Policy — Flowist

Flowist (“Flowist”, “we”, “us”, “our”) is a Sales Readiness & Life Operations platform operated by DM Ventures Group, LLC, a limited liability company. This Privacy Policy explains what data we collect, why we collect it, the sub-processors we rely on, and the rights available to you under US state privacy laws including the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”).

Notice at Collection (Summary)

What we collect: identifiers (name, email, Google account ID, profile photo), customer records (workspace/role metadata), commercial information (subscription and billing status), internet or other electronic activity (Deal Room presence, audit logs), and geolocation inferred from IP address at coarse granularity.
Why: to authenticate you, deliver the service, maintain security and tenant isolation, and process payments.
Sold or shared for cross-context behavioral advertising: No. We do not sell your personal information and we do not share it for cross-context behavioral advertising as those terms are defined under CCPA/CPRA.
Retention: for the lifetime of your workspace, subject to the retention schedule in Section 4.
Sensitive personal information: we do not use or disclose sensitive personal information for purposes beyond what is necessary to provide the service; you have no additional right to limit its use because we do not use it in ways that trigger that right.

1. Data We Collect

Identity Data

When you sign in, we collect identifiers required to authenticate you and associate you with the correct workspace and project memberships. This includes:

Google OAuth profile — name, email address, profile photo, and the unique Google account identifier.
Email + Magic Link — the email address you submit and the one-time tokens used to verify it.
Workspace metadata — your organization, role, and the contact records that link you to specific projects.
Authentication factors — TOTP secrets and recovery codes if you enable multi-factor authentication.

Commercial Data

If you subscribe to a paid plan, our payment processor (Stripe) collects and processes your billing details. We receive subscription status, plan tier, and the last four digits of the payment instrument; we do not store full card numbers on Flowist infrastructure.

Interaction Data

We log specific interactions to support the operational integrity of the platform. This includes Deal Room presence tracking: when an authorized contact opens a Deal Room, we record the project, the contact identifier, and a timestamp. This visibility is strictly internal to the project owner’s workspace and is never surfaced back to the visiting client.

We additionally retain audit logs of mutations performed in the app (creates, updates, deletes) for security, debugging, and tenant isolation purposes.

2. How We Use Your Data

To authenticate you and authorize project-scoped access.
To render the projects, activities, and Deal Rooms you belong to.
To inform project owners when invited contacts have engaged with their shared materials.
To process subscription payments and provide billing history.
To investigate security incidents and platform abuse.
To comply with legal obligations and enforce our Terms.

We do not sell your data. We do not run advertising on the platform.

3. Sources and Sub-processors

We collect personal information directly from you (when you sign in, create content, or subscribe) and from your collaborators (when they invite you to a project or workspace). Flowist relies on the following sub-processors to deliver the service:

Supabase — managed Postgres, authentication, and file storage. Hosts identity, project, and interaction data.
Google — identity provider for OAuth sign-in and related profile information.
Stripe — payment processing and subscription management for paid plans.
Lovable — application hosting and edge runtime that serves the Flowist application.
Email delivery provider — transactional email delivery for authentication, notifications, and account activity.

Each sub-processor receives only the categories of data required to perform its function and is contractually restricted from using that data for its own purposes.

4. Data Retention

Account and identity data: retained for the lifetime of your workspace and deleted within 30 days of a verified deletion request, except where retention is required by law.
Content (projects, activities, files): retained until deleted by you or your workspace owner.
Audit logs and security telemetry: retained for up to 24 months for security and abuse investigation.
Billing records: retained for at least 7 years as required by US tax and accounting rules.

5. Your Rights

Subject to applicable law, you may request access, correction, export, or deletion of your personal data. Requests are honored to the extent we can verify your identity and the absence of overriding legal obligations. Contact us using the details in Section 9.

6. California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights with respect to your personal information:

Right to Know — request the categories and specific pieces of personal information we have collected, the sources, the business or commercial purposes, and the categories of third parties to whom it is disclosed.
Right to Delete — request deletion of personal information we collected from you, subject to statutory exceptions.
Right to Correct — request correction of inaccurate personal information.
Right to Data Portability — receive your personal information in a portable, machine-readable format.
Right to Opt Out of Sale or Sharing — Flowist does not sell or share personal information for cross-context behavioral advertising, so no opt-out is required. If this ever changes we will provide a “Do Not Sell or Share My Personal Information” link before any such processing begins.
Right to Limit Use of Sensitive Personal Information — we do not use sensitive PI in ways that trigger this right.
Right to Non-Discrimination — we will not deny service, charge different prices, or provide a different level of quality because you exercised your rights.

How to submit a request. Email privacy@flowist.co from the email address associated with your Flowist account. To verify your request we will match the sending address against our records and may ask you to confirm information already in your account. We will respond within 45 days; where necessary we may extend this by an additional 45 days and notify you of the extension.

Authorized agents. You may designate an authorized agent to submit requests on your behalf. The agent must provide written proof of authorization and we may require you to verify your identity directly.

Shine the Light. California Civil Code § 1798.83 permits California residents to request information about disclosures of personal information to third parties for direct marketing. Flowist does not disclose personal information to third parties for their direct marketing purposes.

7. Other US State Residents

Residents of Colorado, Connecticut, Nevada, Texas, Utah, Virginia, and other US states with comprehensive privacy laws have substantially similar rights to access, correct, delete, and port their personal information, and to opt out of targeted advertising, sale, and certain profiling. Flowist does not engage in targeted advertising, sale, or profiling that produces legal or similarly significant effects. To exercise any right, email privacy@flowist.co from the address associated with your account. You may appeal any denial by replying to the response email with the subject line “Appeal”.

8. Children

Flowist is not directed to children and we do not knowingly collect personal information from anyone under 16. If you believe a minor has provided us personal information, contact privacy@flowist.co and we will delete it.

9. Contact

Privacy requests and questions: privacy@flowist.co. Formal notices may be addressed to DM Ventures Group, LLC (operator of Flowist).

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced in-app or by email to workspace owners, and the “Last updated” date at the top of this page will be revised.